Nympho 1.0 Virus

Virus Name: Nympho 1.0 Aliases: Nympho Mitosis V Status: Rare Discovered: September, 1993 Symptoms: .COM & .EXE file growth; system hangs, possibly with beeping; decrease in total system & available free memory; program corruption Origin: Unknown Eff Length: 839 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, Sweep, ViruScan, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, AVTK/N, NProt, IBMAV/N, NShld, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Nympho 1.0, or Nympho Mitosis, virus was submitted in September, 1993. Its origin or point of isolation is unknown. Nympho 1.0 is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Nympho 1.0 infected program is executed, this virus will install itself at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK progam, will have decreased by 1,136 bytes. Interrupt 21 will be hooked by Nympho 1.0 in memory. While Nympho 1.0 is a memory resident virus, it infects programs in a direct manor. Each time an infected program is executed, this virus will infect one .COM file located in the current directory. Infected programs will have a file length increase of 839 bytes, though the file length increase will not be visible with the virus memory resident. The Nympho 1.0 virus will located at the end of infected files. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all Nympho 1.0 infected programs: "[Nympho Mitosis] v1.0 Copyright (c) 1993 Memory Lapse" System hangs, possibly accompanied by beeping on the system speaker, may occur when infected programs are executed. This virus will also sometimes corrupt the programs it infects. Known variant(s) of Nympho 1.0 are: Nympho.230: Received in January, 1995, Nympho.230 is a 230 byte variant of the Nympho 1.0 virus described above. It installs itself memory resident in a "hole" in allocated system memory, hooking interrupt 21. Once resident, it infects .COM files when they are executed. Infected programs increase in size by 230 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code: "[ML/PS]" Origin: Unknown January, 1995.